IBM Becomes Critical ICT Provider Under EU DORA Framework
The European Union’s Digital Operational Resilience Act (DORA) sets out to strengthen the reliability of technology across the financial sector.
The regulation applies to financial institutions such as banks, insurers and investment firms, as well as their core Information and Communication Technology (ICT) service providers. It requires these organisations to demonstrate their ability to prevent, contain and recover from digital incidents and service disruptions.
IBM has been named a critical ICT third-party provider under DORA by the European Supervisory Authorities (ESAs), which include the European Banking Authority (EBA), the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA).
The designation places IBM within direct regulatory supervision as part of the EU’s approach to mitigating third-party risks in financial operations.
IBM’s designation recognises the interdependent nature of technology supply chains and their role in enabling the continuity of Europe’s financial ecosystem. Its services and infrastructure support many institutions within DORA’s scope, linking its compliance with the broader operational stability of the sector.
IBM expands focus on regulatory alignment
The designation introduces ongoing oversight by the European Supervisory Authorities. Under the arrangement, IBM will be required to work closely with the ESAs to support continuous monitoring and evaluation of its resilience measures, governance frameworks and technology recovery capabilities.
In a statement, IBM notes: “This designation places IBM in-scope for supervision by European Supervisory Authorities as a critical third-party provider and we will work closely with the ESAs to ensure operational and technical resilience that is critical to Europe’s financial system.”
IBM highlights its existing collaboration with regulators and financial bodies across multiple jurisdictions, highlighting that compliance and risk management form part of its established operating model.
Its engagement with European authorities under DORA extends the history of cooperation into a formalised supervisory role.
IBM support for financial sector clients
IBM reports that the development strengthens its position as a partner to financial institutions preparing for full DORA enforcement.
“For our clients, this designation reinforces IBM’s longstanding commitment to operational resilience and regulatory compliance. We will continue to provide guidance and resources to help financial institutions meet their own DORA obligations while maintaining innovation and competitiveness,” the company states.
Ahead of the regulation’s implementation, IBM has been coordinating requirements across its technology and services units to align both its internal processes and client offerings with DORA obligations.
These requirements cover cybersecurity standards, incident response processes and resilience testing requirements that will apply across the EU’s financial system once the regulation is entirely in effect.
We continually strengthen our cybersecurity technologies, defences and governance worldwide to meet the highest standards of security and operational resilience.
IBM says it continues to adapt its cybersecurity governance and technical controls to meet heightened regulatory expectations.
IBM is working with European Supervisory Authorities
The European Supervisory Authorities have the mandate to oversee ICT service providers deemed critical to financial stability, ensuring that their operations and dependencies do not create systemic risk.
IBM’s oversight will involve cooperation on audits, reporting procedures and information sharing relevant to resilience planning.
IBM states that its engagement will be ongoing and constructive: “We look forward to constructive engagement with the European Supervisory Authorities and to drawing on our deep expertise in risk management, cybersecurity and regulatory compliance to help clients navigate evolving requirements with confidence.”
The designation marks an extension of supervisory frameworks that now include non-financial technology providers whose products and services support regulated financial activities.
It situates IBM within a select group of firms tasked with aligning their ICT infrastructure to EU-level standards for operational resilience and risk mitigation.
